@noob-stupid/dsh-plugin-console 0.3.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +446 -0
- package/README.zh.md +401 -0
- package/cordis.patch.yml +5 -0
- package/lib/client.js +2570 -0
- package/lib/index.js +3703 -0
- package/package.json +39 -0
package/LICENSE
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2026 dsh-plugin-console contributors
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
package/README.md
ADDED
|
@@ -0,0 +1,446 @@
|
|
|
1
|
+
> **English**: [README.md](README.md) | **中文**: [README.zh.md](README.zh.md)
|
|
2
|
+
|
|
3
|
+
---
|
|
4
|
+
|
|
5
|
+
<img width="1170" height="609" alt="image" src="https://github.com/user-attachments/assets/b802d606-14ba-4151-9956-ff642ed12b0a" />
|
|
6
|
+
|
|
7
|
+
# DSH Plugin Hub (dsh-plugin-hub)
|
|
8
|
+
|
|
9
|
+
[](https://github.com/deepseek-ai/deepseek-harness)
|
|
10
|
+
[](https://awesome-dsh-plugin.com)
|
|
11
|
+
[](https://github.com/Noob-stupid/dsh-plugin-hub/stargazers)
|
|
12
|
+
[](LICENSE)
|
|
13
|
+
[](https://github.com/Noob-stupid/dsh-plugin-hub/commits/main)
|
|
14
|
+
[](https://github.com/Noob-stupid/dsh-plugin-hub/actions/workflows/registry.yml)
|
|
15
|
+
[](https://github.com/topics/dsh-plugin)
|
|
16
|
+
|
|
17
|
+
A **plugin management panel** for the DeepSeek Harness (DSH) Web GUI: one-click
|
|
18
|
+
enable/disable of installed plugins, a **multi-source plugin marketplace**
|
|
19
|
+
(GitHub / Gitee / custom sources) with one-click install, an **auto-collected
|
|
20
|
+
static plugin & skill index** refreshed by CI every 6 hours, skill install/disable,
|
|
21
|
+
suite one-click assembly, and **one-click framework upgrade** (online install with
|
|
22
|
+
auto-rollback).
|
|
23
|
+
(GitHub / Gitee / custom sources) with one-click install — and an **auto-collected
|
|
24
|
+
static plugin & skill index** refreshed by CI every 6 hours.
|
|
25
|
+
|
|
26
|
+
<!-- TOC -->
|
|
27
|
+
- [Highlights](#highlights)
|
|
28
|
+
- [One-click install](#one-click-install)
|
|
29
|
+
- [Usage](#usage)
|
|
30
|
+
- [Features](#features)
|
|
31
|
+
- [How it works](#how-it-works)
|
|
32
|
+
- [Compatibility](#compatibility)
|
|
33
|
+
- [Project layout](#project-layout)
|
|
34
|
+
- [HTTP endpoints](#http-endpoints)
|
|
35
|
+
- [Local AI fallback & consent dialog](#local-ai-fallback--consent-dialog)
|
|
36
|
+
- [Framework patch (cordis.patch.yml parse tolerance)](#framework-patch-cordispatchyml-parse-tolerance)
|
|
37
|
+
- [Security](#security)
|
|
38
|
+
- [Disclaimer](#disclaimer)
|
|
39
|
+
- [Known limitations](#known-limitations)
|
|
40
|
+
- [Help](#help)
|
|
41
|
+
- [Ecosystem & discoverability](#ecosystem--discoverability)
|
|
42
|
+
- [Support](#support)
|
|
43
|
+
- [Changelog](#changelog)
|
|
44
|
+
- [License](#license)
|
|
45
|
+
<!-- /TOC -->
|
|
46
|
+
|
|
47
|
+
---
|
|
48
|
+
|
|
49
|
+
## Highlights
|
|
50
|
+
|
|
51
|
+
| | Benefit | Detail |
|
|
52
|
+
|---|---|---|
|
|
53
|
+
| 🧩 | **Plugin & skill hub** | Auto-collected index of `dsh-plugin` topic repos (**500+** by stars) plus a **Skills tab** (`agent-skills` ∪ `claude-skills` ∪ `dsh-skill`, up to 300) — browse, search, one-click install, no GitHub API calls |
|
|
54
|
+
| 🤖 | **Auto-collection CI** | GitHub Actions reruns `build-index` every 6 hours (manual trigger available); authors just add the `dsh-plugin` / `agent-skills` / `claude-skills` / `dsh-skill` topic — no application needed |
|
|
55
|
+
| ⚡ | **Instant, rate-limit-free** | The index is served as a static `marketplace/index.json` via jsDelivr CDN (10-min host cache); terminal users make **zero GitHub API calls** |
|
|
56
|
+
| 🔄 | **Version detection & one-click update** | Installed entries are matched against npm `dist-tags.latest` automatically; cards show **「更新 → vX」**; subpackage mismatch warnings prevent mixed-version breakage |
|
|
57
|
+
| 🔀 | **Multi-source** | GitHub / Gitee (direct-repo mode) / custom search sources (URL template + header auth + private http); `⊞` merges GitHub + all custom sources in parallel |
|
|
58
|
+
| 🔒 | **Safe by default** | Loopback-only routes; AI fallback behind an explicit cost-consent modal; infrastructure rows are toggle-protected |
|
|
59
|
+
|
|
60
|
+
> **For plugin authors**: add the `dsh-plugin` topic to your repo — the official
|
|
61
|
+
> [topic list](https://github.com/topics/dsh-plugin) is how both the ecosystem and this
|
|
62
|
+
> hub discover you. For skills, add `agent-skills` / `claude-skills` / `dsh-skill`.
|
|
63
|
+
|
|
64
|
+
---
|
|
65
|
+
|
|
66
|
+
## One-click install
|
|
67
|
+
|
|
68
|
+
### Option 1: official command (recommended)
|
|
69
|
+
|
|
70
|
+
The plugin declares a `dsh.bundle` manifest, so a single command installs and enables it:
|
|
71
|
+
|
|
72
|
+
```sh
|
|
73
|
+
dsh plugin --profile web add github:Noob-stupid/dsh-plugin-hub
|
|
74
|
+
```
|
|
75
|
+
|
|
76
|
+
Uninstall / reinstall (update):
|
|
77
|
+
|
|
78
|
+
```sh
|
|
79
|
+
dsh plugin --profile web remove github:Noob-stupid/dsh-plugin-hub
|
|
80
|
+
dsh plugin --profile web add github:Noob-stupid/dsh-plugin-hub
|
|
81
|
+
```
|
|
82
|
+
|
|
83
|
+
Then restart the dsh service → refresh the page → Settings → Plugins → Plugin Console.
|
|
84
|
+
|
|
85
|
+
### Option 2: deploy script (fallback when network is restricted)
|
|
86
|
+
|
|
87
|
+
Windows (PowerShell):
|
|
88
|
+
|
|
89
|
+
```powershell
|
|
90
|
+
git clone https://github.com/Noob-stupid/dsh-plugin-hub "$env:TEMP\dsh-plugin-console" 2>$null; & "$env:TEMP\dsh-plugin-console\deploy.ps1"
|
|
91
|
+
```
|
|
92
|
+
|
|
93
|
+
Linux / macOS:
|
|
94
|
+
|
|
95
|
+
```bash
|
|
96
|
+
git clone https://github.com/Noob-stupid/dsh-plugin-hub /tmp/dsh-plugin-console 2>/dev/null; bash /tmp/dsh-plugin-console/deploy.sh
|
|
97
|
+
```
|
|
98
|
+
|
|
99
|
+
The script copies the plugin into `$DSH_HOME/profiles/<profile>/node_modules/` and
|
|
100
|
+
idempotently appends an enable entry to `cordis.patch.yml`. Afterwards:
|
|
101
|
+
|
|
102
|
+
1. Restart the dsh service (host code changes need a process restart; CLI restarts the
|
|
103
|
+
process, the desktop client exits and reopens);
|
|
104
|
+
2. Refresh the page → Settings → Plugins → **Plugin Console**.
|
|
105
|
+
|
|
106
|
+
### Option 3: hand it to an AI in one sentence
|
|
107
|
+
|
|
108
|
+
> Install the DSH plugin hub (dsh-plugin-hub): run `dsh plugin --profile web add github:Noob-stupid/dsh-plugin-hub`; if there is no dsh CLI, clone https://github.com/Noob-stupid/dsh-plugin-hub to `~/.dsh/profiles/web/node_modules/` and register it in `cordis.patch.yml` (id: plugin-console, name: @deepseek-ai/dsh-plugin-console). Restart dsh web afterwards.
|
|
109
|
+
|
|
110
|
+
Requires: DSH ≥ 0.1.0-rc.6 (web profile, with `dsh-client-modules` / `dsh-host-plugin-inventory`).
|
|
111
|
+
|
|
112
|
+
---
|
|
113
|
+
|
|
114
|
+
## Usage
|
|
115
|
+
|
|
116
|
+
1. Restart DSH → open the Web GUI → **Settings → Plugins → Plugin Console**.
|
|
117
|
+
2. **Installed list**: toggle plugins on/off (HMR applies within ~1s), search by name/id,
|
|
118
|
+
expand details (version, repository, README summary).
|
|
119
|
+
3. **Marketplace**: empty query on the GitHub source opens the static index (instant);
|
|
120
|
+
type a query to search live. Switch sources via the login pill (GitHub / Gitee / custom);
|
|
121
|
+
`⊞` merges all sources; `★` filters to `dsh plugin add`-installable packages.
|
|
122
|
+
4. **Skills tab**: switch 插件/技能 next to the search box to browse and install skills
|
|
123
|
+
(cloned into `~/.dsh/skills/<name>/`).
|
|
124
|
+
5. **Install**: click 添加到本地 → the chain runs in the background (safe to leave the page);
|
|
125
|
+
「检测更新」/「更新 → vX」 appear automatically for installed entries.
|
|
126
|
+
|
|
127
|
+
---
|
|
128
|
+
|
|
129
|
+
## Features
|
|
130
|
+
|
|
131
|
+
### Installed plugins (one-click toggle + details)
|
|
132
|
+
|
|
133
|
+
- **Shows only third-party plugins by default** (extra/non-bundled), tagged
|
|
134
|
+
"Third-party" with a delete entry; click "All" to see the full list (1.5s flash feedback);
|
|
135
|
+
- Lists every plugin entry (name, load state, enabled state); search by name/id;
|
|
136
|
+
- Disable = append `- id: X` + `disabled: true` to the user patch layer, effective via HMR;
|
|
137
|
+
- Enable = remove that entry; bundle-layer rows disabled by default are overridden with
|
|
138
|
+
`disabled: false`;
|
|
139
|
+
- Tags "Patch-disabled / Patch-forced" distinguish user patch state;
|
|
140
|
+
- **Infrastructure protection**: host transport/hmr/storage/settings chain plugins
|
|
141
|
+
(70+ rows) are marked "Protected" and cannot be toggled — disabling them would break HMR;
|
|
142
|
+
- **Details panel**: version, repository/homepage links and a README summary for each plugin;
|
|
143
|
+
- **Version check**: 检测更新 reads npm `dist-tags.latest` (curl channel, works even when
|
|
144
|
+
node networking is blocked) and warns about subpackages that need syncing (depsOutdated).
|
|
145
|
+
|
|
146
|
+
### Framework one-click upgrade (deepseek-harness card)
|
|
147
|
+
|
|
148
|
+
- The **deepseek-harness** card shows **「框架升级 → vX」** when a newer framework version is
|
|
149
|
+
available (stable `latest` preferred; `next` channel when `latest` equals the installed
|
|
150
|
+
version); clicking runs the full flow: backup config + framework snapshot (rollback point)
|
|
151
|
+
→ **online install** (service stays up, page never disconnects) → version verification →
|
|
152
|
+
**auto-restart to apply**;
|
|
153
|
+
- **Real-time progress**: a `DSH-Upgrade` console window pops up showing live pnpm download
|
|
154
|
+
progress; the in-panel progress card shows the waiting time;
|
|
155
|
+
- **Upgrade protection**: failed installs **auto-rollback** (robocopy, backup verified before
|
|
156
|
+
upgrade), version check catches fake success, 10-min hard timeout, stall detection
|
|
157
|
+
(no debug-log updates → auto switch registry), global trap fallback, and 15-min stale-state
|
|
158
|
+
cleanup — the framework is never left broken;
|
|
159
|
+
- **pnpm channel**: npm-cli.js freezes at startup in the schtasks task environment (0-byte
|
|
160
|
+
debug log, no network requests ever sent); upgrades use `corepack pnpm` (starts in ~0.4s,
|
|
161
|
+
installed rc.8 in 11.5s) against the **npmmirror (China) registry**, with
|
|
162
|
+
`dangerouslyAllowAllBuilds` so native modules (node-pty/koffi) compile;
|
|
163
|
+
- **Runtime bin resolution**: under the pnpm layout `@deepseek-ai/dsh` is a Junction — the
|
|
164
|
+
relaunch step resolves `bin.js` at runtime (follows the Junction to the current version)
|
|
165
|
+
instead of using a path baked in at script-generation time;
|
|
166
|
+
- **Card dismiss semantics**: terminal states (done/failed) are permanently dismissed on ✕
|
|
167
|
+
(persisted); in-progress dismissal is session-only and the card returns after a refresh.
|
|
168
|
+
|
|
169
|
+
### Marketplace (multi-source)
|
|
170
|
+
|
|
171
|
+
- **Source switcher**: click the login pill to switch between **GitHub / Gitee / custom
|
|
172
|
+
sources** (persisted); title, loading text, placeholder and note all follow the source;
|
|
173
|
+
- **GitHub**: default query `dsh-plugin`, browser-direct with server fallback;
|
|
174
|
+
- **Gitee**: official search API is retired, so it uses **direct-repo mode** — enter
|
|
175
|
+
`owner/repo` (Chinese paths and full URLs supported) to find and install a repository;
|
|
176
|
+
- **Custom sources**: add in Source Manager (URL template with `{q}`/`{page}` placeholders),
|
|
177
|
+
optional **header auth** (e.g. `Authorization: Bearer ...`), and **local/private http URLs**;
|
|
178
|
+
- **Multi-source summary**: the `⊞` toggle searches GitHub + all custom sources in parallel,
|
|
179
|
+
merging results with source labels;
|
|
180
|
+
- **★ official filter**: shows only packages installable via `dsh plugin add` — root packages
|
|
181
|
+
with a `dsh.bundle` manifest (official) or aggregate repos whose **subpackage carries
|
|
182
|
+
`dsh.bundle`** (subpackage-installable); markers are enriched by the server (curl dual-channel)
|
|
183
|
+
with a client-side fallback;
|
|
184
|
+
- **Type badges**: 官方 / 聚合 / 技能 (repo contains SKILL.md) recognized automatically.
|
|
185
|
+
|
|
186
|
+
### Static index market (plugin & skill tabs)
|
|
187
|
+
|
|
188
|
+
> **Hybrid architecture**: browsing uses the static index (instant, zero GitHub API calls),
|
|
189
|
+
> searching uses live channels (GitHub search API / multi-source parallel) — they complement
|
|
190
|
+
> each other: a brand-new repo can be found by live search even before it enters the index.
|
|
191
|
+
|
|
192
|
+
- Empty query on the GitHub source shows the **static index** (`marketplace/index.json`,
|
|
193
|
+
jsDelivr CDN + 10-min host cache): 500+ plugins by stars, instant, **zero GitHub API calls**;
|
|
194
|
+
- **插件 / 技能 tabs** next to the search box: the skills tab lists auto-collected
|
|
195
|
+
`agent-skills` ∪ `claude-skills` ∪ `dsh-skill` repos (up to 300);
|
|
196
|
+
- **Auto version check**: installed entries in the market are checked against npm
|
|
197
|
+
`dist-tags.latest` in the background — cards turn into **「更新 → vX」** buttons;
|
|
198
|
+
- **Skill install**: skill entries install by git-clone into `~/.dsh/skills/<name>/`
|
|
199
|
+
(frontmatter `name` wins over repo name; SKILL.md found at repo root or first-level
|
|
200
|
+
subdirectory). Installed skills show a grey 「已装」 badge.
|
|
201
|
+
|
|
202
|
+
### Source Manager
|
|
203
|
+
|
|
204
|
+
The floating "Sources" button (right of the title row, semi-transparent) opens the manager:
|
|
205
|
+
|
|
206
|
+

|
|
207
|
+
|
|
208
|
+
- **Install sources (registry)**: add / inline edit / set primary / restore defaults;
|
|
209
|
+
private and intranet addresses supported; **deletion is protected** (install-critical);
|
|
210
|
+
- **Search sources**: built-in GitHub, Gitee + custom search sources (add/remove, `🔒` shows
|
|
211
|
+
header count);
|
|
212
|
+
- **Gitee login (optional)**: direct mode needs no login; login only raises rate limits —
|
|
213
|
+
create a third-party app (gitee.com → Data management → Third-party apps, scopes
|
|
214
|
+
user_info, projects), fill client_id / client_secret, save, then authorize.
|
|
215
|
+
|
|
216
|
+
---
|
|
217
|
+
|
|
218
|
+
## How it works
|
|
219
|
+
|
|
220
|
+
### Toggle semantics
|
|
221
|
+
|
|
222
|
+
The DSH web profile is composed of a bundle patch layer plus the user patch layer
|
|
223
|
+
(`$DSH_HOME/profiles/web/cordis.patch.yml`); patches are **per-key overrides**.
|
|
224
|
+
Toggling a plugin just appends/removes two YAML lines:
|
|
225
|
+
|
|
226
|
+
```yaml
|
|
227
|
+
- id: plugin-entry-id
|
|
228
|
+
disabled: true
|
|
229
|
+
```
|
|
230
|
+
|
|
231
|
+
The config watcher (HMR) recomposes within ~1s — no restart needed except for host code.
|
|
232
|
+
|
|
233
|
+
### Install chain
|
|
234
|
+
|
|
235
|
+
```
|
|
236
|
+
configured registries (primary→backup, default npmmirror → npmjs)
|
|
237
|
+
→ curl manual install (node networking blocked: tarball into node_modules)
|
|
238
|
+
→ git channel (GitHub via proxy+direct, Gitee via its platform)
|
|
239
|
+
→ EPERM stale-dir cleanup retry
|
|
240
|
+
→ repository subpackage expansion (aggregate packages first)
|
|
241
|
+
→ local AI fallback (behind an explicit cost-consent modal)
|
|
242
|
+
```
|
|
243
|
+
|
|
244
|
+
Skills install directly by `git clone --depth 1` → copy SKILL.md bundle into
|
|
245
|
+
`~/.dsh/skills/<name>/` (no npm, no patch, no restart).
|
|
246
|
+
|
|
247
|
+
### Data sources
|
|
248
|
+
|
|
249
|
+
```
|
|
250
|
+
GitHub Actions (every 6h, repo token)
|
|
251
|
+
└─ scripts/build-index.cjs: pages topic:dsh-plugin (500 by stars) + skills topics (300)
|
|
252
|
+
└─ commits marketplace/index.json back to main
|
|
253
|
+
└─ host reads it via jsDelivr CDN (10-min cache) → instant market, zero API calls
|
|
254
|
+
└─ live search still uses the GitHub search API (browser-direct + server channel)
|
|
255
|
+
```
|
|
256
|
+
|
|
257
|
+
### Version detection & installed recognition
|
|
258
|
+
|
|
259
|
+
- **Installed recognition**: match installed entries by `repository` field or module name
|
|
260
|
+
against market items (repo name → package name mapping);
|
|
261
|
+
- **Version detection**: `check-update` reads npm `dist-tags.latest` via curl; for aggregate
|
|
262
|
+
packages it also compares subpackage declared vs actual versions (depsOutdated) to prevent
|
|
263
|
+
mixed-version startup conflicts.
|
|
264
|
+
|
|
265
|
+
---
|
|
266
|
+
|
|
267
|
+
## Compatibility
|
|
268
|
+
|
|
269
|
+
- Supports the **DSH 0.1.0 series** (`0.1.0-rc.6` and siblings).
|
|
270
|
+
- The panel reads the running `@deepseek-ai/dsh-web-app` version: after a breaking upgrade
|
|
271
|
+
(0.2 / 1.0) a compatibility warning appears instead of silent failure.
|
|
272
|
+
- Likely breaking seams: patch semantics, `webServer.register`, loader entry shape,
|
|
273
|
+
`dsh.client` bundle format, `settings.plugins.tab` slot.
|
|
274
|
+
- Deploy scripts do not check versions; the in-panel warning is authoritative.
|
|
275
|
+
|
|
276
|
+
---
|
|
277
|
+
|
|
278
|
+
## Project layout
|
|
279
|
+
|
|
280
|
+
```
|
|
281
|
+
lib/index.js Host plugin (/plugin-console/* routes + patch I/O + multi-source search + install)
|
|
282
|
+
lib/client.js Browser bundle (ModuleLoader format, settings tab)
|
|
283
|
+
scripts/build-index.cjs Index builder (plugins --limit 500 / skills --skills --limit 300)
|
|
284
|
+
scripts/apply-framework-patch.cjs Framework patch (issue #5, idempotent)
|
|
285
|
+
.github/workflows/registry.yml Auto-collection CI (every 6h + manual dispatch)
|
|
286
|
+
marketplace/index.json Generated static index (jsDelivr CDN)
|
|
287
|
+
deploy.ps1 / deploy.sh One-click deploy scripts (Windows / Linux·macOS)
|
|
288
|
+
test-harness.mjs Logic self-test (state/toggle/validation/loopback; search SKIP by network)
|
|
289
|
+
```
|
|
290
|
+
<img width="1878" height="945" alt="image" src="https://github.com/user-attachments/assets/b26f2f19-0ba4-4be7-9ca1-b3fd4c51a7a8" />
|
|
291
|
+
|
|
292
|
+
---
|
|
293
|
+
|
|
294
|
+
## HTTP endpoints
|
|
295
|
+
|
|
296
|
+
| Endpoint | Method | Purpose |
|
|
297
|
+
|---|---|---|
|
|
298
|
+
| `/plugin-console/state` | GET | Plugin list + patch state + compat + running install jobs |
|
|
299
|
+
| `/plugin-console/toggle` | POST | Enable/disable an entry (writes user patch layer) |
|
|
300
|
+
| `/plugin-console/uninstall` | POST | Remove entry + uninstall package (bundle-aware) |
|
|
301
|
+
| `/plugin-console/search` | POST | Multi-source search (github/gitee/custom, `multi` merge) |
|
|
302
|
+
| `/plugin-console/repo` | POST | Repo metadata: package.json, private root, dsh hint, **hasSkill** |
|
|
303
|
+
| `/plugin-console/enrich` | POST | Server-side type markers (official/aggregate/skill) |
|
|
304
|
+
| `/plugin-console/install` | POST | Install (plugin or `kind: skill`), returns a job id |
|
|
305
|
+
| `/plugin-console/install-status` | POST | Poll an install job |
|
|
306
|
+
| `/plugin-console/check-update` | POST | npm latest version + subpackage mismatch check |
|
|
307
|
+
| `/plugin-console/market-index` | POST | Static index (jsDelivr CDN, 10-min cache) |
|
|
308
|
+
| `/plugin-console/skills-installed` | GET | Installed skills under `~/.dsh/skills` |
|
|
309
|
+
| `/plugin-console/sources` | GET/POST | Registry & search-source manager, Gitee OAuth setup |
|
|
310
|
+
| `/plugin-console/gitee-oauth-url` / `gitee-oauth-callback` | GET | Gitee OAuth flow |
|
|
311
|
+
| `/plugin-console/ai-consent` | POST | Approve/cancel the AI-fallback step |
|
|
312
|
+
| `/plugin-console/restart` | POST | Watchdog-safe self-restart (panel button equivalent) |
|
|
313
|
+
|
|
314
|
+
---
|
|
315
|
+
|
|
316
|
+
## Local AI fallback & consent dialog
|
|
317
|
+
|
|
318
|
+
Installation goes through a **deterministic channel chain**:
|
|
319
|
+
`configured sources (primary→backup) → curl manual install → git channel → EPERM cleanup retry
|
|
320
|
+
→ repository subpackage expansion`. Only when all deterministic channels fail does the
|
|
321
|
+
**local AI fallback** take over.
|
|
322
|
+
|
|
323
|
+
**What it is**: a local AI subagent takes over the install — it diagnoses like a human
|
|
324
|
+
(inspects repo structure, finds subpackages/aggregate packages, cleans leftovers), installs
|
|
325
|
+
with the right package manager and writes the config. **Note: this step calls a DeepSeek API
|
|
326
|
+
model and may incur API costs.**
|
|
327
|
+
|
|
328
|
+
**Consent dialog (cost transparency)**:
|
|
329
|
+
|
|
330
|
+
1. After all deterministic channels fail, the task enters "waiting for authorization" and a
|
|
331
|
+
top-most modal appears:
|
|
332
|
+
- explicitly states "will call a DeepSeek API model, may incur API costs"
|
|
333
|
+
- offers **Approve, continue** / **Cancel** (Cancel = zero cost)
|
|
334
|
+
- auto-cancels after 10 minutes
|
|
335
|
+
2. The modal offers **"Don't ask again"** (auto-approve) — restorable at the bottom of the
|
|
336
|
+
marketplace page.
|
|
337
|
+
3. The floating **"AI fallback"** toggle can disable the feature entirely: deterministic
|
|
338
|
+
failures cancel the install, **never calling a model API (zero cost)**.
|
|
339
|
+
|
|
340
|
+
---
|
|
341
|
+
|
|
342
|
+
## Framework patch (cordis.patch.yml parse tolerance)
|
|
343
|
+
|
|
344
|
+
**Problem (issue #5)**: if `cordis.patch.yml` contains a top-level `[]` placeholder plus
|
|
345
|
+
later entries (two YAML root nodes), DSH fails at startup:
|
|
346
|
+
`end of the stream or a document separator is expected`.
|
|
347
|
+
|
|
348
|
+
**Fix location**: `parsePatchList` in the DSH framework `dsh-app-boot` — on parse failure,
|
|
349
|
+
top-level empty-array placeholder lines are dropped (treated as no-op) and parsing retries;
|
|
350
|
+
normal files, pure `[]` files, and indented sub-arrays are unaffected.
|
|
351
|
+
|
|
352
|
+
**Apply** (re-run after every DSH upgrade, which overwrites framework files):
|
|
353
|
+
|
|
354
|
+
```bash
|
|
355
|
+
node scripts/apply-framework-patch.cjs
|
|
356
|
+
```
|
|
357
|
+
|
|
358
|
+
The script locates `dsh-app-boot/lib/index.js` in the npx cache, skips when already patched
|
|
359
|
+
(idempotent), and keeps a `.bak-issue5` backup on first apply.
|
|
360
|
+
|
|
361
|
+
---
|
|
362
|
+
|
|
363
|
+
## Security
|
|
364
|
+
|
|
365
|
+
- All routes are loopback-only;
|
|
366
|
+
- GitHub metadata is used only to discover public plugins; npm installs keep full TLS
|
|
367
|
+
validation against the registry;
|
|
368
|
+
- GitHub search is browser-direct; Gitee/custom source requests and headers (including
|
|
369
|
+
credentials) are handled server-side only and never shipped to the browser;
|
|
370
|
+
- Custom source URLs accept https and local/private http only (127.0.0.1, localhost,
|
|
371
|
+
10.x, 192.168.x, 172.16-31.x, etc.);
|
|
372
|
+
- Skills are plain files (SKILL.md + assets) — installing a skill does **not** execute code;
|
|
373
|
+
the git clone comes from the repo you chose, review the repo before installing.
|
|
374
|
+
|
|
375
|
+
---
|
|
376
|
+
|
|
377
|
+
## Disclaimer
|
|
378
|
+
|
|
379
|
+
- The marketplace lists third-party repositories from GitHub; each plugin is developed and
|
|
380
|
+
maintained by its own author and has **no affiliation with DeepSeek Harness or this hub**.
|
|
381
|
+
- This hub makes **no warranty** about any plugin's quality, reliability, security, license
|
|
382
|
+
compliance or compatibility. Listing is **not an endorsement** — install means you have
|
|
383
|
+
reviewed and accepted the risk. Read the repo source and README before installing.
|
|
384
|
+
- This hub is provided AS-IS; neither the hub nor its developers are liable for any damage
|
|
385
|
+
(data loss, system damage, privacy leaks) caused by installing or using third-party plugins.
|
|
386
|
+
|
|
387
|
+
---
|
|
388
|
+
|
|
389
|
+
## Known limitations
|
|
390
|
+
|
|
391
|
+
- Host code changes require a **service restart** (the panel's restart button is
|
|
392
|
+
watchdog-safe); client changes just need a page refresh;
|
|
393
|
+
- Live GitHub search depends on GitHub reachability (browser-direct + server fallback;
|
|
394
|
+
during network-blackout windows retry later);
|
|
395
|
+
- Version detection works for npm-published packages; skill-type repos have no version concept;
|
|
396
|
+
- The static index is capped (500 plugins / 300 skills per build); authors bump their star
|
|
397
|
+
count or wait for the 6h CI cycle to enter the index;
|
|
398
|
+
- Skills are discovered by `dsh-skill-filesystem` — if the current profile does not enable
|
|
399
|
+
that plugin, installed skills stay dormant until it is enabled and DSH restarted.
|
|
400
|
+
|
|
401
|
+
---
|
|
402
|
+
|
|
403
|
+
## Help
|
|
404
|
+
|
|
405
|
+
- **Panel missing**: restart dsh → refresh → Settings → Plugins → Plugin Console.
|
|
406
|
+
- **Toggle does nothing**: infrastructure rows are "Protected" (by design); normal toggles
|
|
407
|
+
take effect via HMR within 1-3s.
|
|
408
|
+
- **Compatibility warning**: a breaking upstream release arrived; see Compatibility.
|
|
409
|
+
- **Search empty/fails**: GitHub uses browser-direct (falls back to the server channel);
|
|
410
|
+
Gitee is direct-repo mode (enter `owner/repo`); check custom-source URL/headers; retry
|
|
411
|
+
during network blackout windows.
|
|
412
|
+
- **★ filter empty**: ★ shows only `dsh plugin add`-installable packages (official +
|
|
413
|
+
subpackage-bundle aggregates); markers are backfilled in 1-3s — no false "none" report.
|
|
414
|
+
- **Install fails**: confirm the repo has package.json and the package is published; npm
|
|
415
|
+
failures fall back to git install; switch the primary source if npmmirror is unstable.
|
|
416
|
+
- **Skill not found by DSH**: enable `@deepseek-ai/dsh-skill-filesystem` in the profile
|
|
417
|
+
(`cordis.yml`) and restart; skills live in `~/.dsh/skills/<name>/`.
|
|
418
|
+
|
|
419
|
+
---
|
|
420
|
+
|
|
421
|
+
## Ecosystem & discoverability
|
|
422
|
+
|
|
423
|
+
- Listed on [awesome-dsh-plugin](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin) (the community main list) and [DSH Directory](https://dsh.directory);
|
|
424
|
+
- This hub's own auto-collection index (500+ plugins / 300 skills, refreshed by CI every 6h) includes **any** repo tagged `dsh-plugin` / `agent-skills` / `claude-skills` / `dsh-skill` — tag your repo and it appears in the market automatically, no application needed;
|
|
425
|
+
- If you build DSH plugins, this panel is your distribution channel: one-click install for every user of the hub.
|
|
426
|
+
|
|
427
|
+
## Support
|
|
428
|
+
|
|
429
|
+
If this panel saves you time or makes DSH more fun to use:
|
|
430
|
+
|
|
431
|
+
- ⭐ **Star this repo** — it directly helps more DSH users find it;
|
|
432
|
+
- Share it with DSH users or in DSH communities;
|
|
433
|
+
- Submit your own plugin (tag it `dsh-plugin`) to grow the ecosystem;
|
|
434
|
+
- Found a bug or want a feature? [Open an issue](https://github.com/Noob-stupid/dsh-plugin-hub/issues).
|
|
435
|
+
|
|
436
|
+
---
|
|
437
|
+
|
|
438
|
+
## Changelog
|
|
439
|
+
|
|
440
|
+
See [CHANGELOG.md](CHANGELOG.md).
|
|
441
|
+
|
|
442
|
+
---
|
|
443
|
+
|
|
444
|
+
## License
|
|
445
|
+
|
|
446
|
+
MIT
|